Comparison
Secret rotationvsShort-lived credential
Secret rotation
you replace the API key on a schedule, which means the system must tolerate two valid keys at once during the changeover.
Periodically replacing credentials so that an undetected leak has a bounded lifetime. The mechanism that makes it possible is overlap: accept both old and new during a window, or every rotation is an outage. A secret that cannot be rotated without downtime will not be rotated.
Full entry →Short-lived credential
the token the workload holds expires in fifteen minutes, so a leaked one is worth almost nothing by the time it is found.
Credentials issued on demand with a short lifetime and renewed continuously, rather than static secrets that live until someone rotates them. It converts the security question from 'has this leaked' to 'how long is the window', and it removes rotation as a scheduled human task. It requires an identity the issuer trusts, which is why it and workload identity always arrive together.
Full entry →